feat(grok): add Grok Build adapter (hooks, settings, session parse/tail, upstream pin)

[darko-mijic]

What

Adds Grok Build as a second supported agent harness, alongside Claude:

• Hook support (src/grok/): envelope types + Zod validation for the 15 accepted wire values (14 wire events + legacy subagent_end), GrokHookOutputBuilder (gate allow/deny; stop block/approve/force-stop/additionalContext), and the executeGrokHook runner with Grok's fail-open exit semantics (Grok-local stdin reader — zero CLAUDE_* config coupling).
• Settings validation: JSON (fail-fast) + TOML (skip-bad-event-group) hook configs, command/http handlers, the full 51-spelling event-key alias table — ported from upstream config.rs.
• Session processing (src/grok/processing/): discovery (GROK_HOME ?? ~/.grok, URL-encoded cwd with blake3 slug fallback >255B), parsers for updates.jsonl (ACP + xAI sessionUpdate unions, known/unknown/invalid tag-peek — unknown variants never fatal) and events.jsonl (~60-variant Event union), a bounded JSONL cursor, checkpointed two-source tailing (revisioned markers, per-source reset events, manual/automatic commit modes), and a Grok-native upsert/delete change model with rewind support.
• Upstream pin: six contract files vendored from grok-build @ e5fd4816 / SOURCE_REV ea094a8c under docs/upstream/grok/ (Apache-2.0 NOTICE), drift tests that re-parse the vendored Rust on every run, and scripts/sync-upstream-grok.mjs --check as the drift alarm.
• Public surface: @libar-dev/agent-harness-kit/grok and /grok/processing subpath exports; root "." and all Claude exports byte-identical.
• Docs: docs/reference/grok-adapter.md — event/envelope/stdout contracts, settings semantics, session layout, pin/drift policy, and the Grok-vs-Claude incompatibility matrix.

What it deliberately does NOT do

Attach-only: it does not start or drive Grok sessions. No Claude-to-Grok translator, no 30-event parity, no mcp_tool/prompt/agent handlers, no ask/defer/updatedInput outputs (Grok ignores them), no new CLI bins, no edits to existing Claude modules (src/types, src/validation, src/utils, src/processing byte-clean).

Verification

• pnpm run test:run exit 0 — 1710/1710 (56 files), including 168 new Grok tests
• pnpm run type-check, pnpm run lint, pnpm run build — all exit 0
• Real-machine QA: all 15 hook-envelope fixtures validate; tailing a copy of a real ~/.grok session (11,682 records) is byte-identical across runs with 0 invalid lines; sync-upstream-grok.mjs --check exit 0
• Drift tests pin the hook-event table and the events union to the vendored files
• Note: the branch also bumps tsx 4.21.0 → 4.23.12 (dev-only) — 7 pre-existing test failures on Node 26 (DEP0205 stderr contamination, proven identical at base 6a08ff3) are fixed by it; zero product-surface impact

Decisions to sanity-check

• Rewind semantics: the reducer implements strict-after deletes (> target_prompt_index) per the approved plan; upstream replay.rs implements rewind-before-N (>= N). Documented in docs/reference/grok-adapter.md.
• Cardinality: 14 wire events + 1 legacy alias = 15 accepted wire values (GrokHookEventName.length === 15, drift-test pinned).
• blake3 via @noble/hashes (audited, ESM, zero deps) for >255-byte cwd slugs — decision recorded in docs/upstream/grok/pin.json notes.

Greptile Summary

This PR adds the Grok adapter, including hook handling, session processing, public exports, documentation, and upstream contract checks. The previously reported stale tool-state behavior was exercised with status-only and kind-only updates: the current reducer updates the existing tool-use block and keeps terminal tool-use and tool-result states aligned.

Confidence Score: 5/5

Safe to merge: no blocking failure remains.

No blocking failure remains. Direct reducer and filesystem tailing checks confirmed that incremental terminal tool updates preserve consistent normalized state.

T-Rex Logs

What T-Rex did

• Validated that a parsed-update-to-reducer flow with an initial tool call followed by a status-only completed update yields a tool_use with status completed and a matching tool_result, and confirmed all tests in tests/grok-blocks.test.ts passed.
• Validated incremental session handling by running a filesystem JSONL tail scenario that emits a tool call and a status-only completion, and confirmed all tests in tests/grok-blocks.test.ts and tests/grok-tail.test.ts passed.
• Compared baseline runtime output to the post-fix runtime output to verify the grok blocks merge logic correctly updates and retains status and kind fields, with focused test output captured.
• Observed that after the final validation, both tool_use and tool_result report completed status, production sources remained unchanged, and the validation artifacts clearly narrate the changes.

_{Ran code and verified through T-Rex}

_{Reviews (2): Last reviewed commit: "fix(grok): merge tool_call_update status..." | Re-trigger Greptile}